SearchProtocolHost.exe

Windows ProcessMicrosoft Corporation

Also called searchprotocolhost, search protocol host

WindowsSystem Component

Windows Search protocol handler host. It loads ISearchProtocol handlers to crawl URIs. SearchIndexer.exe writes the catalog. SearchFilterHost.exe loads IFilters.

What you need to know

Protocol host crawls. It does not write the catalog and does not load IFilters.

SearchProtocolHost.exe is the Windows Search protocol handler host. It opens file, MAPI, and other URI protocols so the indexer can see items. SearchIndexer.exe writes the catalog. SearchFilterHost.exe isolates IFilters. SearchApp.exe is UI.

Safe?: Yes, with Windows Search
Does it write the index?: No. SearchIndexer does
Does it load IFilters?: No. SearchFilterHost does

Feex says

If I see SearchProtocolHost busy after I added a folder, I check Indexing Options first. I rebuild the catalog last, and I do not blame SearchFilterHost for a crawl.

What is SearchProtocolHost.exe?

SearchProtocolHost.exe is the protocol handler host. It loads ISearchProtocol implementations to crawl URIs. It does not write the catalog. SearchIndexer.exe does that. It does not load IFilters. SearchFilterHost.exe does that.

What does it do?

It enumerates items through protocol handlers (file system, Outlook, custom handlers). Parsed text still goes through the filter host. The catalog write is the indexer.

Why is it running?

WSearch is crawling a location you included, a new PST, or a URI a protocol handler owns. Disk here is the crawl, not SearchApp drawing suggestions.

Why are there multiple copies?

More than one protocol host can crawl different URIs at once. None of those copies write the catalog. SearchIndexer.exe does that.

Is it safe?

Usually safe

System32 SearchProtocolHost.exe is the crawl host. A copy in a "speed up search" zip is not. This file still does not write the catalog and still does not load IFilters.

A legitimate copy normally runs from:

C:\Windows\System32\SearchProtocolHost.exe

Expected publisher: Microsoft Corporation
Catalog writer: SearchIndexer.exe
IFilter host: SearchFilterHost.exe

Can I end it?

The crawl pauses

Ending SearchProtocolHost.exe stops that protocol crawl until the indexer starts another host. It does not wipe the catalog. It does not unload IFilters in SearchFilterHost.

Can I remove it?

Do not delete SearchProtocolHost.exe. Remove a location in Indexing Options if you want less crawling. Disable WSearch only if you accept unindexed search.

Should it start with Windows?

WSearch starts protocol hosts on demand. This is not a Startup Apps row next to SearchApp.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Rises while a protocol handler enumerates a large URI space
Memory: Moderate during a deep crawl
Disk: Reads from the crawled location. Catalog writes are the indexer
Network: UNC or other remote protocol handlers

File information

SearchProtocolHost.exe file information
Executable name	SearchProtocolHost.exe
Common legitimate path	C:\Windows\System32\SearchProtocolHost.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

High disk blamed on SearchFilterHost

Filter CPU is content parsing. Protocol-host disk is walking folders and mail stores. Split those in Resource Monitor.

Outlook crawl never ends

A MAPI protocol handler can keep this host busy. Reduce Outlook indexing in Indexing Options before you rebuild.

Troubleshooting

Diagnose before you change anything destructive.

Trim Indexing Options locations first

Drop the huge folder or the stale UNC. That stops the protocol host without touching IFilters.

Rebuild the index last

A rebuild restarts crawls and filters. Use it after you fix locations or a broken protocol handler, not as click one.

Technical details

SearchProtocolHost.exe technical details
Image name	SearchProtocolHost.exe
Role	ISearchProtocol crawl host

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: protocol handlers · ISearchProtocol hosts crawl URIs
Microsoft Support: search indexing · Locations and rebuild belong to the indexer
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.